Undeletable, automatically duplicating program

Question

I found a folder called "DVD maker" when cleaning my computer, I can't remember installing it and certainly don't have any use for it so I thought I'd uninstall it. It did not appear in the add/remove programs so I tried to shift-delete it and run ccleaner to be done with it, and thats when the problem arose.

---

---

So obviously this isin't right, and obviously it's some kind of malware. I have avast! anti-virus installed and scanning my computer shows no results. I downloaded and installed a program called 'file shredder', which I have used in the past to deal with these kinds of problems, but to no avail:

---

---

The string of numbers you see is what the folder 'DVD maker' renamed itself to after I tried shredding it the first time, it does this every time I try to delete it, the original folder seems to dissapear/be deleted and a new one appears, in a new (randomly) numbered folder.

My question is, how do I get rid of 'DVD maker'?

Answer 1

It’s not a virus (it’s much too large to be legitimate malware which tries to be small to avoid detection). Moreover, DVDMaker is the Microsoft program for making and using DVDs. It is included with Windows and can be removed via the Windows components dialog. You can access it in two ways:

• Start⇨optionalfeatures
• Control Panel:
  1. Open the Programs and Features Control Panel applet
  2. Click Turn Windows features on or off:

Now uncheck Windows DVD Maker from the Media Features branch and click [OK]:

---

If it were a virus, the problem would be one of two things:

1. Files are in use
2. Insufficient permissions

Files in use

Dealing with in-use files requires two steps:

1. Determine the source of the files in use
2. Unlock the files or determine the source of the execution and stop it

Determine the lock

This is simple enough; just a program like Unlocker and run it on the files or folder to find out what programs (executable files) are locking the file(s).

Unlock the files

This is equally simple; just click Unlock All in the Unlocker dialog. You should now be able to delete the previously locked files.

One warning though: depending on what is locking it (e.g., a driver), it may not be possible to unlock it or worse, may crash the computer, so you will want to use the next step instead.

Determine the source of execution

It is more advisable to find where/how the executable that is locking the files is being run and stop it. This can be done with tools like Autoruns. Just look for the executable that you saw in Unlocker and disable (and later on, delete) it.

Then reboot, and now the program/driver/etc. should not be running, which leaves the target files unlocked and deleteable.

Permission problems

The error displayed in your screenshot clearly indicates that the files are only write-accessible by TrustedInstaller which is a virtual user account used by Windows for updates and such (which is normal for Windows components).

You will need to add yourself to the permissions of the file(s)/folder(s) in question. You can do this via the Security tab of their Properties dialog(s):

Since it is owned by TrustedInstaller, you will first need to take ownership before adding permissions. This is done through the Advanced button. It may be easier to do it from the command-line instead:

1. Open an elevated command-prompt (Start⇨cmd.exe then either press Ctrl+Shift+Enter or right-click and select Run as Administrator)

2. Change to the correct folder, for example:

   cd "C:\Program Files\DVDMaker"
   

3. Take ownership:

   takeown /r /f .
   

4. Grant permissions:

   icacls . /grant everyone:f /t
   

5. Delete:

   cd ..
   rd /s /q "DVDMaker"
   

Answer 2

I don't think its any malware. It's obviously in Program Files folder, isn't it? DVD Maker comes along with several versions of Windows Vista, 7 (atleast in my case). And on my PC, the folder looks pretty much the same(execpt for folder names).

Wikipedia has a short article on that. So, have a look at it. http://en.wikipedia.org/wiki/Windows_DVD_Maker

And its unlikely that a virus, or a malware would reside in a dedicated folder. If you wish to get rid of it anyway, goto the Control Panel > Uninstall A Program and Click 'Turn Windows features on and off'. DVD Maker is listed under 'Media Features' there. Before attempting deleting or shredding, try doing that.

If it convince you to be more of a malware, try running the shredder with admin privilages. Good Luck